CVE-2026-109565 zofe CVE debrief

Who should care

Defenders responsible for Rapyd Admin instances, particularly those with self-registration enabled, should assess exposure and prioritize patching or mitigation efforts. This includes administrators, security teams, and vulnerability management teams who oversee Rapyd Admin deployments.

Why it matters

The stored XSS vulnerability in Rapyd Admin 9.4.0 before 9.20.0 allows unauthenticated attackers to inject scripts, potentially impacting system integrity and data confidentiality. Defenders should prioritize verifying exposure and applying patches or mitigations.

• Potential for script injection and execution in administrator sessions
• Possible impact on system integrity and data confidentiality
• Need for verification of exposure and patch application
• Potential for exploitation through self-registration

Technical summary

The Rapyd Admin application from version 9.4.0 before 9.20.0 contains a stored cross-site scripting (XSS) vulnerability. This vulnerability allows unauthenticated attackers to inject scripts through self-registered display names, which are rendered unescaped in the Activity log Author filter. The injected scripts can execute in an administrator's session, potentially impacting system integrity and data confidentiality. The vulnerability is particularly concerning for Rapyd Admin instances with self-registration enabled.

Defensive priority

Defenders should prioritize verifying exposure in Rapyd Admin instances, particularly those with self-registration enabled, and apply patches or mitigations as soon as possible.

Recommended defensive actions

• Verify Rapyd Admin instance versions and configurations to determine exposure
• Apply patches or mitigations to vulnerable instances
• Monitor for suspicious activity or self-registration attempts
• Consider implementing additional security controls for Rapyd Admin instances
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the stored XSS vulnerability in Rapyd Admin 9.4.0 before 9.20.0, including the affected versions and a patch commit. The vulnerability allows unauthenticated attackers to inject scripts through self-registered display names. The patch commit and release notes for Rapyd Admin v9.20.0 provide additional context for defenders to verify exposure and apply patches or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.